Add PR_4_ruby detector files by branedev2 · Pull Request #6 · branedev2/pr_on_dl_old

branedev2 · 2025-07-15T13:04:27Z

No description provided.

amazon-q-developer · 2025-07-15T13:04:31Z

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

gemini-code-assist

Summary of Changes

Hello @branedev2, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a comprehensive suite of new security detectors for Ruby applications. The primary goal is to expand our static analysis coverage for Ruby, enabling better identification of common security vulnerabilities through practical compliant and non-compliant code examples.

Highlights

New Ruby Security Detectors: I've added 15 new security detectors specifically designed for Ruby applications. These detectors aim to enhance static analysis capabilities by identifying common vulnerabilities.
Compliant and Non-Compliant Examples: Each new detector includes a pair of Ruby files (_compliant.rb and _non-compliant.rb) that provide clear examples of both secure and insecure coding practices related to the specific vulnerability.
Broad Vulnerability Coverage: The newly introduced detectors cover a wide array of security concerns, including code injection, command injection, cross-site scripting (XSS), insecure file and FTP access, improper regex validation, insecure session cookie configurations, and the use of deprecated AWS AppConfig APIs.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds a comprehensive set of compliant and non-compliant code examples for various Ruby security detectors. The examples cover a wide range of vulnerabilities. My review has identified a critical logic error in one of the compliant examples which, if used as a reference, would lead to a security vulnerability. I have also provided several suggestions to improve code clarity and adhere to common Ruby style conventions.

gemini-code-assist · 2025-07-15T13:07:10Z

+class HomeController < ApplicationController
+    def compliant 
+        text = params[:text]  
+        if text !~ /\A[\w]+\z/


There is a logical error in this validation. The condition if text !~ /\A[\w]+\z/ executes the shell command when the input is invalid, which is the opposite of the intended behavior for a compliant example. This could lead to command injection.

The condition should be inverted to only allow validated input to be used in the shell command.

if text =~ /\A[\w]+\z/

gemini-code-assist · 2025-07-15T13:07:11Z

+# {fact rule=ruby-avoid-tainted-file-access@v1.0 defects=1}
+class UsersController < ApplicationController
+    def noncompliant
+        path_to_validate = "/tmp/validity_" + params[:file_id]


For improved readability and performance, it's idiomatic in Ruby to prefer string interpolation ("#{...}") over string concatenation (+).

path_to_validate = "/tmp/validity_#{params[:file_id]}"

gemini-code-assist · 2025-07-15T13:07:11Z

+
+# {fact rule=ruby-check-cookie-store-session-security-attributes@v1.0 defects=1}
+# Noncompliant: `httponly` is set to `false`.
+ Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: false, domain: :all


This line has a leading space, which affects code alignment and is inconsistent with standard Ruby formatting. Please remove it.

Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: false, domain: :all

gemini-code-assist · 2025-07-15T13:07:11Z

+# {fact rule=ruby-check-validation-regex@v1.0 defects=0}
+class Account < ActiveRecord::Base
+    # Compliant: Ruby regex behavior is multiline by default. `\A` has been used to indicate the beginning of a line and `\Z` has been used to denote the end of a line.
+    validates :username, :length => 6..20, :format => /\A[a-zA-Z]+\z/


The hash syntax using => with symbol keys is outdated. Please use the modern Ruby 1.9+ hash syntax (key: value) for better readability and consistency.

validates :username, length: 6..20, format: /\A[a-zA-Z]+\z/

gemini-code-assist · 2025-07-15T13:07:11Z

+# {fact rule=ruby-check-validation-regex@v1.0 defects=1}
+class Account < ActiveRecord::Base
+    # Noncompliant: `Ruby regex behavior is multiline by default. `\A` has not been used indicate the beginning of a line and `\Z` has not been used to denote the end of a line.
+    validates :username, :length => 6..20, :format => /^[a-zA-Z]+$/


The hash syntax using => with symbol keys is outdated. Please use the modern Ruby 1.9+ hash syntax (key: value) for better readability and consistency.

validates :username, length: 6..20, format: /^[a-zA-Z]+$/

gemini-code-assist · 2025-07-15T13:07:11Z

+# SPDX-License-Identifier: MIT-0
+
+# {fact rule=ruby-dangerous-exec@v1.0 defects=0}
+def compliant()


It is idiomatic in Ruby to omit parentheses for method definitions that take no arguments.

def compliant

gemini-code-assist · 2025-07-15T13:07:11Z

+# SPDX-License-Identifier: MIT-0
+
+# {fact rule=ruby-dangerous-exec@v1.0 defects=1}
+def noncompliant()


It is idiomatic in Ruby to omit parentheses for method definitions that take no arguments.

def noncompliant

gemini-code-assist · 2025-07-15T13:07:11Z

+# SPDX-License-Identifier: MIT-0
+
+# {fact rule=ruby-divide-by-zero@v1.0 defects=0}
+def noncompliant 


The method name noncompliant is misleading in a file intended to demonstrate a compliant code pattern. It should be renamed to compliant to avoid confusion.

def compliant

gemini-code-assist · 2025-07-15T13:07:12Z

+    variable = 3
+    zero = 0
+    # Noncompliant: Division by zero.
+    value = variable/zero


For better readability, please add spaces around the division operator (/).

value = variable / zero

amazon-q-developer · 2025-07-15T13:10:04Z

+# {fact rule=ruby-dangerous-syscall@v1.0 defects=1}
+def noncompliant
+    # Noncompliant: `syscall` is used to execute an arbitrary system command.
+    syscall 4, 1, "hello\n", 6


Caution
Description: Avoid using syscalls directly, as it poses security risks and may lead to vulnerabilities. Instead, use higher-level abstractions provided by the language or libraries to ensure safer and more secure code.

Severity: Critical

The fix replaces the low-level syscall with Ruby's built-in IO.write method, which provides a safer and more abstracted way to write to standard output. This eliminates the security risks associated with direct syscalls.

Suggested change

syscall 4, 1, "hello\n", 6

# Using Ruby's built-in IO class for safer output

def compliant

IO.write(STDOUT.fileno, "hello

")

end

amazon-q-developer · 2025-07-15T13:10:05Z

+
+    def noncompliant(user_input)
+        # Noncompliant: Using backticks (`) to execute shell commands.
+        result = `foo #{user_input} bar`


Caution
Description: Detected a dangerous subshell execution vulnerability where user input is directly used in a shell command without proper sanitisation. This could allow an attacker to inject and execute arbitrary system commands, potentially leading to system compromise or data breach. To remediate, avoid using shell commands with user input when possible, or implement strict input validation and use shell escaping functions like Shellwords.escape(). If shell execution is necessary, consider using a allow list of allowed commands and arguments. Link to more info : https://guides.rubyonrails.org/security.html

Severity: Critical

The fix uses the Shellwords.escape method to safely escape the user input before including it in the shell command, preventing command injection vulnerabilities. This ensures that special characters in the user input are properly escaped and cannot be interpreted as part of the shell command.

Suggested change

result = `foo #{user_input} bar`

# Import the Shellwords module for safe shell escaping

require 'shellwords'

def noncompliant(user_input)

# Use Shellwords.escape to safely escape user input

escaped_input = Shellwords.escape(user_input)

result = `foo #{escaped_input} bar`

end

amazon-q-developer · 2025-07-15T13:10:06Z

+    file_to_remove = params[:file_to_remove] 
+
+    # Noncompliant: `exec` seems to have external input.
+    exec(["rm", "-rf", file_to_remove])


Caution
Description: Potential security risk detected. Avoid using user-controllable input in exec or spawn, as it may lead to code injection vulnerabilities. Dynamic execution of external commands can expose your application to malicious input. Consider safer alternatives to mitigate the risk of code injection vulnerabilities.

Severity: Critical

The fix replaces the unsafe exec call with built-in Python functions for file operations, validates the file path to ensure it's within a safe directory, and uses appropriate methods to remove files or directories securely.

Suggested change

exec(["rm", "-rf", file_to_remove])

# Import os for safe file operations

# Import shutil for high-level file operations

def noncompliant()

file_to_remove = params[:file_to_remove]

# Use os.path.abspath to get the absolute path and ensure it's within a safe directory

safe_path = os.path.abspath(file_to_remove)

if safe_path.startswith('/safe/directory/'):

if os.path.exists(safe_path):

if os.path.isfile(safe_path):

os.remove(safe_path)

elif os.path.isdir(safe_path):

shutil.rmtree(safe_path)

else:

raise ValueError("Invalid file path")

end

amazon-q-developer · 2025-07-15T13:10:07Z

+class HomeController < ApplicationController
+    def compliant 
+        text = params[:text]  
+        if text !~ /\A[\w]+\z/


Caution
Description: The condition for input validation is inverted, potentially allowing dangerous input. Change the condition to if text =~ /\A[\w]+\z/ to only process valid input.

Severity: Critical

The fix addresses the inverted condition in the input validation. The original code if text !~ /\A[\w]+\z/ would allow dangerous input to be processed. The fix changes it to if text =~ /\A[\w]+\z/, ensuring that only valid input (consisting of word characters) is processed, thus improving the security of the code by preventing potential command injection vulnerabilities.

Suggested change

if text !~ /\A[\w]+\z/

class HomeController < ApplicationController

def compliant

text = params[:text]

if text =~ /\A[\w]+\z/

# Compliant: The `text` variable is validated for an expected format before being passed to the shell command.

result = `simple-math "#{text}" 2> /dev/null`.strip

puts text + " = " + result

amazon-q-developer · 2025-07-15T13:10:08Z

+        file_to_send = params[:file]
+
+        # Noncompliant: Sending a file from the server to the client without validation.
+        send_file file_to_send 


Warning
Description: Never allow user input in send_file to prevent security risks. Allowing this input could let a malicious user access any file on the server. Avoid using user input directly in send_file. If necessary, use File.basename(...) along with File.expand_path() ensure path is as expected. For more info - https://guides.rubyonrails.org/security.html

Severity: High

The fix validates the file path to ensure it's within an allowed directory before sending the file. It uses the Pathname class to manipulate and validate file paths securely.

Suggested change

send_file file_to_send

# Import the File class from Ruby's core library

# This is used for file path manipulation and validation

require 'pathname'

def noncompliant

file_to_send = params[:file]

# Validate the file path to ensure it's within an allowed directory

base_path = Pathname.new('/path/to/allowed/directory')

full_path = base_path.join(file_to_send).cleanpath

if full_path.to_s.start_with?(base_path.to_s) && File.file?(full_path)

send_file full_path.to_s

else

render :nothing => true, :status => 401

end

end

amazon-q-developer · 2025-07-15T13:10:09Z

+        # Noncompliant: Using user controlled input being used for an ftp session.
+        ftp = Net::FTP.new(host)
+
+        ftp.login(ENV['FTP_USERNAME'], ENV['FTP_PASSWORD'])


Warning
Description: The code is flagged for using user-supplied params in FTP operations, leading to potential command injection vulnerabilities. The risk is that attackers could execute arbitrary commands or manipulate files. To remediate, validate and sanitize all user inputs or use hardcoded, trusted values in FTP commands. Link to more info : https://owasp.org/Top10/A01_2021-Broken_Access_Control/

Severity: High

The fix implements a whitelist of allowed FTP hosts and checks if the user-supplied host is in this list before proceeding with the FTP connection, mitigating the risk of arbitrary command execution or file manipulation.

Suggested change

ftp.login(ENV['FTP_USERNAME'], ENV['FTP_PASSWORD'])

def noncompliant

# Using a whitelist of allowed hosts for FTP connections

allowed_hosts = ['ftp.example.com', 'ftp.trusted-domain.com']

host = params[:host]

if allowed_hosts.include?(host)

ftp = Net::FTP.new(host)

ftp.login(ENV['FTP_USERNAME'], ENV['FTP_PASSWORD'])

begin

ftp.getbinaryfile("/tmp/config", "local/ftp_config")

render plain: "File downloaded successfully. "

rescue Net::FTPPermError => e

render plain: "Permission error: #{e.message}", status: :forbidden

ensure

ftp.close if ftp

end

else

render plain: "Invalid host", status: :forbidden

end

end

amazon-q-developer · 2025-07-15T13:10:10Z

+
+# {fact rule=ruby-check-cookie-store-session-security-attributes@v1.0 defects=1}
+# Noncompliant: `httponly` is set to `false`.
+ Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: false, domain: :all


Warning
Description: The code snippets are flagged for not setting httponly and/or secure attributes for cookies. This exposes cookies to client-side access and potential interception, risking sensitive data leakage. To remediate, always set httponly: true to prevent JavaScript access and secure: true to ensure cookies are transmitted over HTTPS only. Link to more info : https://owasp.org/www-community/HttpOnly

Severity: High

The fix sets the 'httponly' attribute to true to prevent client-side access to cookies, and adds the 'secure' attribute set to true to ensure cookies are only transmitted over HTTPS, addressing the vulnerability of potential sensitive data leakage.

Suggested change

Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: false, domain: :all

Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: true, secure: true, domain: :all

amazon-q-developer · 2025-07-15T13:10:11Z

✅ I finished the code review, and left comments with the issues I found. I will now generate code fix suggestions.

Add PR_4_ruby detector files

a18c4e4

gemini-code-assist Bot reviewed Jul 15, 2025

View reviewed changes

amazon-q-developer Bot reviewed Jul 15, 2025

View reviewed changes

-        result = `foo #{user_input} bar`
+# Import the Shellwords module for safe shell escaping
+require 'shellwords'
+def noncompliant(user_input)
+  # Use Shellwords.escape to safely escape user input
+  escaped_input = Shellwords.escape(user_input)
+  result = `foo #{escaped_input} bar`
+end

-    exec(["rm", "-rf", file_to_remove])
+# Import os for safe file operations
+# Import shutil for high-level file operations
+def noncompliant()
+    file_to_remove = params[:file_to_remove]
+    # Use os.path.abspath to get the absolute path and ensure it's within a safe directory
+    safe_path = os.path.abspath(file_to_remove)
+    if safe_path.startswith('/safe/directory/'):
+        if os.path.exists(safe_path):
+            if os.path.isfile(safe_path):
+                os.remove(safe_path)
+            elif os.path.isdir(safe_path):
+                shutil.rmtree(safe_path)
+    else:
+        raise ValueError("Invalid file path")
+end

-        send_file file_to_send
+# Import the File class from Ruby's core library
+    # This is used for file path manipulation and validation
+    require 'pathname'
+    def noncompliant
+        file_to_send = params[:file]
+        # Validate the file path to ensure it's within an allowed directory
+        base_path = Pathname.new('/path/to/allowed/directory')
+        full_path = base_path.join(file_to_send).cleanpath
+        if full_path.to_s.start_with?(base_path.to_s) && File.file?(full_path)
+            send_file full_path.to_s
+        else
+            render :nothing => true, :status => 401
+        end
+    end

-        ftp.login(ENV['FTP_USERNAME'], ENV['FTP_PASSWORD'])
+def noncompliant
+        # Using a whitelist of allowed hosts for FTP connections
+        allowed_hosts = ['ftp.example.com', 'ftp.trusted-domain.com']
+        host = params[:host]
+        if allowed_hosts.include?(host)
+            ftp = Net::FTP.new(host)
+            ftp.login(ENV['FTP_USERNAME'], ENV['FTP_PASSWORD'])
+            begin
+                ftp.getbinaryfile("/tmp/config", "local/ftp_config")
+                render plain: "File downloaded successfully. "
+            rescue Net::FTPPermError => e
+                render plain: "Permission error: #{e.message}", status: :forbidden
+            ensure
+                ftp.close if ftp
+            end
+        else
+            render plain: "Invalid host", status: :forbidden
+        end
+    end

	Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: false, domain: :all
	Rails.application.config.session_store :cookie_store, key: '_rails3_session', httponly: true, secure: true, domain: :all

Conversation

branedev2 commented Jul 15, 2025

Uh oh!

amazon-q-developer Bot commented Jul 15, 2025

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

amazon-q-developer Bot Jul 15, 2025

Choose a reason for hiding this comment